Using intermediate mappings to prevent data loss from ransomware

Abstract

A storage driver for a storage space (e.g., hard disk volume) may use intermediate mappings for write, create, and delete requests to prevent data loss from ransomware. The storage driver receives a request to overwrite a data item (e.g., file or object) at a first location of a storage space and in response, writes data to a second location of the storage space. The storage driver also generates a write mapping that associates the first location with the second location. At a later point in time, the storage driver may determine whether to commit the request to overwrite the data item. If the storage driver determines not to commit the request to overwrite the data item (due to the data being the result of a ransomware attack), then the storage driver deletes the write mapping, preventing the first location from being overwritten (preventing data loss from a ransomware attack).

What is claimed is: 
     
         1 . A system, comprising:
 one or more processors and one or more memories, wherein the one or more memories have stored thereon instructions, which when executed by the one or more processors, cause the one or more processors to implement a storage service for a plurality of clients of a provider network, wherein the storage service is configured to:
 process an overwrite request to overwrite an existing data item located at a first location of a storage space with a new data item indicated by the overwrite request by:
 writing the new data item to a second location of the storage space; 
 generating an intermediate write mapping that associates the first location of the existing data item with the second location that the new data item was written to based on the overwrite request to overwrite the existing data item; 
 storing the intermediate write mapping to enable the storage service to serve read requests for the existing data item with the new data item; 
 determining whether to commit the overwrite request to overwrite the existing data; and 
 in response to determining to commit the overwrite request to overwrite the existing data item at the first location with the new data item indicated by the overwrite request:
 overwriting the existing data item at the first location with the new data item that was previously stored at the second location based on reception of the overwrite request to overwrite the existing data item and delete the intermediate write mapping that indicates an association between the first location of the existing data item and the second location that the new data item was written to, or 
 updating data item location information of the existing data item to indicate the second location that the new data item was previously stored at based on reception of the overwrite request instead of the first location of the existing data item, deleting the existing data item at the first location, and deleting the intermediate write mapping that indicates the association between the first location of the existing data item and the second location that the new data item was previously stored at based on the reception of the overwrite request; and 
 
 in response to determining not to commit the overwrite request:
 deleting the new data item and the intermediate write mapping. 
 
 
   
     
     
         2 . The system as recited in  claim 1 , wherein to determine to commit the request to overwrite, the storage driver is further configured to:
 determine that a format of the existing data item at the first location is a same format as a format of the new data item at the second location,   determine that a measurement of entropy of data of the existing data item at the first location is within a predefined entropy threshold of a measurement of entropy of data of the new data item at the second location, or   determine that a simhash of the data at the first location is within a predefined similarity threshold of a simhash of the data at the second location.   
     
     
         3 . The system as recited in  claim 1 , wherein to determine not to commit the overwrite request, the storage service is further configured to:
 determine that a format of the existing data item at the first location is not a same format as a format of the new data item at the second location.   
     
     
         4 . The system as recited in  claim 1 , wherein to determine not to commit the overwrite request, the storage service is further configured to:
 determine that a measurement of entropy of data of the existing data item at the first location is within a predefined entropy threshold of a measurement of entropy of data of the new data item at the second location, or   determine that a simhash of the data at the first location is within a predefined similarity threshold of a simhash of the data at the second location.   
     
     
         5 . The system as recited in  claim 1 , wherein the storage service is further configured to:
 receive the overwrite request from a compute instance established by the provider network and associated with the client.   
     
     
         6 . A method, comprising:
 performing, by a storage driver implemented by one or more computing devices:
 receiving an overwrite request to overwrite an existing data item at a first location of a storage space with a new data item indicated by the overwrite request; 
 in response to receiving the overwrite request:
 writing the new data item to a second location of the storage space; 
 generating an intermediate write mapping that associates the first location of the existing data item with the second location that the new data item was written to based on the overwrite request to overwrite the existing data item; and 
 storing the intermediate write mapping; 
 
 determining to commit the overwrite request; and 
 in response to determining to commit the overwrite request to overwrite the existing data item at the first location with the new data item indicated by the overwrite request:
 overwriting the existing data item at the first location with the new data item that was previously stored at the second location based on reception of the overwrite request to overwrite the existing data item and deleting the intermediate write mapping that indicates an association between the first location of the existing data item and the second location that the new data item was written to, or 
 updating data item location information of the existing data item to indicate the second location that the new data item was previously stored at based on reception of the overwrite request instead of the first location of the existing data item, deleting the existing data item at the first location, and deleting the intermediate write mapping that indicates the association between the first location of the existing data item and the second location that the new data item was previously stored at based on the reception of the overwrite request. 
 
   
     
     
         7 . The method as recited in  claim 6 , wherein determining to commit the overwrite request comprises:
 determining that a measurement of entropy of data of the existing data item at the first location is within a predefined entropy threshold of a measurement of entropy of data of the new data item at the second location, or   determining that a simhash of the data at the first location is within a predefined similarity threshold of a simhash of the data at the second location.   
     
     
         8 . The method as recited in  claim 6 , wherein determining to commit the overwrite request comprises:
 determining that a format of the existing data item at the first location is a same format as a format of the new data item at the second location.   
     
     
         9 . The method as recited in  claim 6 , wherein determining to commit the overwrite request comprises:
 receiving, from a user, an indication to commit the overwrite request.   
     
     
         10 . The method as recited in  claim 6 , wherein the one or more computing devices are hosted by a provider network, wherein the storage space is associated with a client of the provider network, and wherein determining to commit the overwrite request comprises:
 receiving, from the client, an indication to commit the overwrite request.   
     
     
         11 . The method as recited in  claim 6 , further comprising performing, by the storage driver, prior to the receiving of the overwrite request:
 in response to receiving a read request to read the existing data item, determining that there are no intermediate write mappings stored for the first location; and   in response to determining that there are no intermediate write mappings stored for the first location, return data of the existing data item.   
     
     
         12 . The method as recited in  claim 6 , further comprising performing, by the storage driver:
 receiving a create request to create a new data item, wherein the create request indicates the new data item; and   in response to receiving the create request:
 creating the new data item at a third location of the storage space; 
 generating an intermediate create mapping, wherein the intermediate create mapping associates the third location with the create request; and 
 storing the intermediate create mapping. 
   
     
     
         13 . The method as recited in  claim 6 , further comprising performing, by the storage driver:
 receiving another overwrite request to overwrite another existing data item at a third location of the storage space with another new data item indicated by the other overwrite request;   in response to receiving the other overwrite request, writing the other new data item to a fourth location of the storage space;   based on the writing of the other data item to the storage space, determining that a threshold amount of the storage space is being used as temporary storage of data for requests that have not yet been committed; and   in response to determining that the threshold amount of the storage space is being used as temporary storage of data for requests that have not yet been committed, asking a user whether to commit one or more of the requests that have not yet been committed.   
     
     
         14 . The method as recited in  claim 6 , further comprising performing, by the storage driver:
 receiving a delete request to delete another data item at a third location of the storage space;   in response to receiving the delete request:
 generating an intermediate delete mapping, wherein the intermediate delete mapping associates the third location with the delete request; and 
 storing the intermediate delete mapping; 
   determining to commit the delete request; and   in response to determining to commit the delete request:
 deleting the other data item and deleting the intermediate delete mapping. 
   
     
     
         15 . One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors cause the one or more processors to:
 receive a delete request to delete an existing data item at a particular location of a storage space;   in response to reception of the delete request:
 generate an intermediate delete mapping, wherein the intermediate delete mapping associates the particular location of the storage space indicated by the previously received delete request with the previously received delete request; and 
 store the intermediate delete mapping; 
   determine to commit the delete request; and   in response to the determination to commit the delete request to delete the existing data item at the particular location:
 delete the existing data item at the particular location; and 
 delete the intermediate delete mapping that indicates an association between the particular location of the data item indicated by the previously received delete request and the previously received delete request. 
   
     
     
         16 . The one or more storage media as recited in  claim 15 , wherein to determine to commit the delete request, the program instructions when executed on or across the one or more processors further cause the one or more processors to:
 receive, from a user, an indication to commit the delete request.   
     
     
         17 . The one or more storage media as recited in  claim 15 , wherein the program instructions when executed on or across the one or more processors further cause the one or more processors to:
 receive another delete request to delete another data item at another location of the storage space;   in response to reception of the other delete request:
 generate another intermediate delete mapping that associates the other location with the other delete request; and 
 store the other intermediate delete mapping; 
   receive, from a user, an indication to not commit the other delete request; and   in response to the reception of the indication to not commit the other delete request, delete the other intermediate delete mapping.   
     
     
         18 . The one or more storage media as recited in  claim 15 , wherein the one or more edge devices comprises a plurality of edge devices, and wherein the program instructions when executed on or across the one or more processors further cause the one or more processors to:
 receive a create request to create a new data item based at least on the existing data item; and   in response to reception of the create request:
 create the new data item at another location of the storage space; 
 generate an intermediate create mapping, wherein the intermediate create mapping associates the other location with the create request; and 
 store the intermediate create mapping; and 
   determine to commit the create request; and   in response to the determination to commit the create request:
 delete the intermediate create mapping. 
   
     
     
         19 . The one or more storage media as recited in  claim 15 , wherein the program instructions when executed on or across the one or more processors further cause the one or more processors to:
 receive an overwrite request to overwrite an existing data item at a first location of the storage space with a new data item indicated by the overwrite request;   in response to the reception of the overwrite request, write the new data item to a second location of the storage space;   based on the writing of the new data item to the storage space, determine that a threshold amount of the storage space is being used as temporary storage of data for requests that have not yet been committed; and   in response to the determination that the threshold amount of the storage space is being used as temporary storage of data for requests that have not yet been committed, asking a user whether to commit one or more of the requests that have not yet been committed.   
     
     
         20 . The one or more storage media as recited in  claim 15 , the program instructions when executed on or across the one or more processors further cause the one or more processors to:
 in response to reception of a read request to read an existing data item at a first location, determine that there is an intermediate write mapping stored for the first location; and   in response to the determination that there is an intermediate write mapping stored for the first location, return another data item of a second location.